CVE-2024-48019CWE-22CWE-552

Apache Doris: allows admin users to read arbitrary files through the REST API

Medium · published February 4, 2025

CVSS v3.1
5.4
EPSS
1%
Percentile
63.4
In the wild
Unconfirmed
What it is

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Files or Directories Accessible to External Parties vulnerability in Apache Doris.

Application administrators can read arbitrary

files from the server filesystem through path traversal.

Users are recommended to upgrade to version 2.1.8, 3.0.3 or later, which fixes the issue.

The record
Technical detail
CVSS v3.1
5.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.01031 · 63.4th percentile
Weaknesses
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'); CWE-552 · Files or Directories Accessible to External Parties
Published
2025-02-04T18:19Z
EPSS history
Timeline
  • 04 FEB 18:19Z
    Apache Doris: allows admin users to read arbitrary files through the REST API
    cvelistv5